Back Ground.News

Flatpak 1.16.4 Patches a Silent Security Flaw That Let Sandboxed Apps Peek Outside Their Walls

Ground.News • April 8, 2026

Flatpak, a Linux application sandboxing and distribution framework, released version 1.16.4, patching four security vulnerabilities. The most severe fix addresses a complete sandbox escape that leads to host file access and code execution in the host context, tracked as CVE-2026-34078. File system exposure Two additional fixes address file system exposure on the host. CVE-2026-34079 prevents arbitrary file deletion on the host filesystem. GHSA-2…

A maintenance release for Flatpak, the Linux application sandboxing and distribution framework, has quietly fixed a security vulnerability that undermined one of the technology’s core promises: isolation. The bug, tracked as CVE-2025-4870, allowed a sandboxed application to obtain directory listings from the host system — information that should have been invisible to confined software. The fix arrived in Flatpak 1.16.4, released on June 2, 2025…

That Flatbox app sandboxing and distribution system is out today with important security updates...

Flatpak 1.16.4 addresses a critical sandbox escape vulnerability that could allow host file access and code execution, along with three additional security issues.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Flatpak 1.16.4 Addresses Critical Security Flaws Including Sandbox Escape Flatpak released version 1.16.4 on April 8, 2026, fixing four security vulnerabilities. The most critical issue, CVE-2026-34078, allows a complete sandbox escape, enabling unauthorized host file access and code execution. Two additional vulnerabilities, CVE-2026-34079 and GHSA-2fxp-43j9-pwvc, address file system exposure, preventing arbitrary file deletion and read-access on the host filesystem. These vulnerabilities affect users of the Flatpak framework, which is widely used for Linux application distribution. The fixes are now available, and users are urged to update their systems to mitigate these risks. The vulnerabilities were published on April 7, 2026, indicating a prompt response from the Flatpak team. The potential impact of these vulnerabilities is significant, given the critical nature of the sandbox escape. Current status is that the vulnerabilities have been patched, but users must take action to secure their systems. 4 sources 71

Extracted Entities

CVEs (3)

CVE-2025-4870 CVE-2026-34078 CVE-2026-34079

Platforms (2)

Flatpak Linux